HawkEye Keylogger

Internal ID: win.hawkeye_keylogger

aliases

Last seen:Mar 17, 2026

Intelligence Profile

HawKeye is a keylogger that is distributed since 2013. Discovered by IBM X-Force, it is currently spread over phishing campaigns targeting businesses on a worldwide scale. It is designed to steal credentials from numerous applications but, in the last observed versions, new "loader capabilities" have been spotted. It is sold by its development team on dark web markets and hacking forums.

Threat Analysis

HawkEye Keylogger is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html

→http://www.secureworks.com/research/threat-profiles/gold-galleon

→https://any.run/cybersecurity-blog/hawkeye-malware-technical-analysis/

→https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html

→https://blog.talosintelligence.com/rats-and-stealers-rush-through-heavens/

→https://cloudblogs.microsoft.com/microsoftsecure/2018/07/11/hawkeye-keylogger-reborn-v8-an-in-depth-campaign-analysis/

→https://github.com/itaymigdal/malware-analysis-writeups/blob/main/HawkEye/HawkEye.md

→https://labs.bitdefender.com/2020/03/5-times-more-coronavirus-themed-malware-reports-during-march/?utm_campaign=twitter&utm_medium=twitter&utm_source=twitter

→https://nakedsecurity.sophos.com/2016/02/29/the-hawkeye-attack-how-cybercrooks-target-small-businesses-for-big-money/

→https://research.checkpoint.com/2023/following-the-scent-of-trickgate-6-year-old-packer-used-to-deploy-the-most-wanted-malware/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.hawkeye_keylogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search HawkEye Keylogger